System, method and computer readable medium for processing unsolicited electronic mail

ABSTRACT

An internet service provider (ISP) is configured to analyze a subscriber&#39;s sent e-mail packets to determine a subscriber identity associated with the e-mail packets. A database is then queried to determine a current sending rate of e-mails by the subscriber. A sending rate above an allowed threshold causes the upstream transmission of the e-mail packets to be blocked by injecting connection destroying packets. A subscriber remains blocked from upstream transmission of e-mails until the sending rate as determined by the ISP drops below a second, more stringent threshold. This automatic process is also accompanied by automated messaging to the subscriber with information as to the measures taken and remedial options.

FIELD OF THE INVENTION

This invention relates to monitoring and control of communicationsthrough Internet Service Providers (ISPs) and in particular to themonitoring and control of electronic mail communications.

BACKGROUND OF THE INVENTION

Electronic mail, referred to herein as e-mail, has become the premiercommunication medium. However, the ease and accessibility of e-mailwhich are its great benefits have also contributed to e-mail's greatestdetriment, which is the sending of bulk unsolicited messages knowncolloquially as spam. The majority of unwanted e-mail, SPAM, originatesfrom the PCs of internet subscribers that are controlled by avirus/Trojan infection. It typically falls to an Internet ServiceProvide (ISP) to control the spam e-mails in order to maximize bandwidthefficiency for the ISP. In order to prevent spam e-mails from beingsent, the Internet Service Providers will typically first identify theinfected subscriber who is the source of the spam e-mails, largely fromexternal complaints, and then block further e-mails emanating from thesubscriber while simultaneously assisting the subscriber to remove theinfection from the subscriber's computer. This largely manual procedureis time consuming and personnel intensive.

What is required is a system, method and computer readable medium thatcan provide a more automated procedure for handling spam originatorswithin an e-mail network.

SUMMARY OF THE INVENTION

In one embodiment of the disclosure, there is provided a method ofblocking an electronic mail transmission comprising monitoring anelectronic mail message at a point on a transmission path; determining asubscriber associated with said electronic mail message; determining ifsaid subscriber is a blocked subscriber; and if said subscriber is ablocked subscriber, preventing transmission of said electronic mailmessage from said point.

In one embodiment of the disclosure, there is provided a networkcomprising at least one internet service provider that provides aninternet connection for one or more subscribers; and at least oneelectronic mail processing system comprising at least one database; andat least one query engine that executes one or more queries on said atleast one database; wherein said electronic mail processing systemreceives an electronic mail message received by said at least oneinternet service provider from said one or more subscribers; whereinsaid query engine executes a first query on said at least one databaseto determine a subscriber identity associated with said electronic mailmessage; wherein said query engine executes a second query on said atleast one database to determine a transmission status associated withsaid subscriber identity; and wherein said electronic mail message istransmitted dependent on said transmission status.

In one embodiment of the disclosure, there is provided an internetservice provider comprising at least one router; and a packet processingengine; wherein said at least one router routes one or more electronicmail packets identifying a recipient to said packet processing engine;wherein said packet processing engine determines if said one or moreelectronic mail packets are to be blocked; wherein if said one or moreelectronic mail packet are to be blocked, said packet processing engineroutes a blocking packet to said router; and wherein said routertransmits said blocking packet towards said recipient.

In one embodiment of the disclosure, there is provided a method ofoperating an internet service provider comprising receiving one or morepackets into the internet service provider from a subscriber;determining if transmission upstream of said one or more packets is tobe blocked; and if said transmission upstream of said one or morepackets is to be blocked, blocking upstream transmission of said one ormore packets.

In one embodiment of the disclosure, there is provided a computerreadable medium comprising instructions for receiving a plurality ofelectronic mail messages from a subscriber; determining a sending rateof said plurality of electronic mail messages; comparing said sendingrate with a threshold; and preventing transmission of at least one ofsaid electronic mail messages if said sending rate is above saidthreshold.

BRIEF DESCRIPTION OF THE DRAWINGS

The invention will now be described, by way of example only, withreference to specific embodiments and to the accompanying drawings inwhich:

FIG. 1 schematically illustrates a network in accordance with anembodiment of the disclosure;

FIG. 2 represents a method for preventing e-mail transmission inaccordance with an embodiment of the present disclosure;

FIG. 3 represents a method for preventing email packet transmission inaccordance with an embodiment of the present disclosure;

FIG. 4 schematically illustrates providing a notification to asubscriber of a blocked status;

FIG. 5 represents a processor executing an instruction set forpreventing an e-mail transmission; and

FIG. 6 represents an alternative network configuration.

DETAILED DESCRIPTION OF THE INVENTION

In the Applicant's earlier patent applications, U.S. Ser. No. 10/023,674and U.S. Ser. No. 10/623,893, the entire contents of which areexplicitly incorporated herein by reference, the present Applicantsdescribed networks in which communications could be provided from an ISPto a subscriber of the ISP. In the referenced applications, aredirection device was placed in the path of upstream traffic from thesubscriber. The redirection device, operating under the control of aconsolidating and management device elsewhere in the network, processedupstream data packets to determine when targeted communications to thesubscriber were required.

The present embodiments utilize many of the features and functionalitiesof the networks described in the Applicant's earlier patent applicationsreferenced above. In FIG. 1, there is shown a system or network 10 inaccordance with an embodiment of the disclosure. In the network 10, anISP 12 provides a link between a subscriber device 14 and the internet16. For the sake of clarity, in the following embodiments the subscriberdevice 14 will be referred to specifically as a personal computer, orPC. However, it will be readily understood by the person skilled in theart that the subscriber device 14 may be any internet enabled devicesuch as a personal computer (PC), laptop, palm device, mobile telephone,gaming console and the like, and all such internet enabled devices areto be considered equivalent.

The network 10 includes at least one redirection device 21 that isplaced at the path of upstream traffic 15 from the subscriber 14, eitherin the path or in a position to monitor the path. As described in theabove referenced earlier applications, the redirection device 21 may beplaced at many points within the network 10 and is preferably placed atan edge of the network that represents the last scaleable point in theoperator's network. In one embodiment, the redirection device 21 isplaced within the ISP 12. The term redirection device is used herein inorder to provide consistency with the Applicant's earlier patentapplications referenced above. The person skilled in the art willunderstand from the foregoing description that in the context of thepresent disclosure, the redirection device may not perform a redirectionfunction in all embodiments.

The network 10 also includes a consolidating and management device 26,for example of the type as described in the Applicant's earlierapplications referenced above. The consolidating and management device26 is operatively associated with the redirection device 21 to form anelectronic mail processing system, and more particularly a packetprocessing system, as will be described in greater detail below.

The ISP 12 includes a router or switch 22, a redirection device 21 asdescribed above and an address provisioning database 23. The addressprovisioning database 23 stores associations between subscribers of theISP and IP addresses allocated to the subscribers. A second database 24stores associations between subscribers of the ISP and sending rateprofiles as will be described below. The consolidating and managementdevice 26 provides a query engine for accessing data from the databases23, 24 in response to requests from the redirection device 21.

While two databases 23, 24 are illustrated and described herein forclarity, the person skilled in the art will readily understand that thetwo databases 23, 24 can be consolidated into a single database or thatthe two databases can be divided into a higher number of databases. Forexample, the databases 23, 24 may be consolidated with a database forstoring an association between users and a subscriber account, asdescribed in the Applicant's application Ser. No. 12/004,635, the entirecontents of which are herein incorporated by reference. Alternatively orin addition, the databases 23, 24 may be consolidated with a databasefor storing an association between a subscriber and a shared secret asdescribed in the Applicant's application Ser. No. 12/004,645, the entirecontents of which are herein incorporated by reference.

Downstream traffic from the internet 16, indicated by path 28 is routedby the router 22 to the intended subscriber 14. Upstream traffic in theform of data packets 27 follow the path 15 from the subscriber 14 to berouted by the router 22 to the redirection device 21, thence back to therouter 22 and onto the internet 16. In an alternative embodiment shownin FIG. 6, upstream traffic 15 passes directly through the Internetprovider with the addition of a “mirror port” or “tap” allowing theredirector, 21, to monitor the upstream traffic.

The operation of the system 10 will now be described with reference toFIG. 1 and to the flowchart 100 illustrated in FIG. 2. At step 101, ane-mail message is received and a subscriber associated with the e-mailmessage is identified at step 102. The system 10 then determines if thesubscriber is a blocked subscriber (step 103), and if the subscriber isa blocked subscriber, the transmission of the e-mail message isprevented (step 104).

In one embodiment, the method steps described above are performed withinthe ISP as illustrated in the flowchart 200 of FIG. 3. At step 201, datapackets 27 originating at the subscriber are received in the ISP 12 andprovided to the router 22. The router 22 passes selected packets to theredirection device 21 for processing. For example, the router maydetermine if a data packet is a relevant e-mail packet, such as an SMTPSYN packet, which indicates the commencement of an email message.

If an appropriate e-mail packet is identified, the redirection device 21determines if the upstream transmission of the e-mail message is to beblocked, (step 202). Firstly, the redirection device 21 analyzes thee-mail data packet 27 to retrieve an IP address of the e-mail datapacket 27. The redirection device 21 forwards the IP address to theconsolidation and management device 26, which executes a first query onthe address provisioning database 23 to retrieve a subscriber identityassociated with the IP address. The consolidation and management device26 then executes a second query on the database 24 using the retrievedsubscriber identity to retrieve the subscriber's sending rate profilewhich is forwarded to the redirection device 21. The redirection device21 analyzes the received sending rate profile to determine atransmission status for the subscriber. If the sending rate profileindicates an e-mail sending rate outside of allowed parameters, theredirection device 21 takes steps to block the transmission of thee-mail data packet 27 (step 203), otherwise, the data packet isredirected back to the router 21 where it continues transmission on theupstream path 29. The attempt to send the e-mail data packet isincorporated into the sending rate profile which is updated in thedatabase 24.

In one embodiment, the subscribers are blocked from sending e-mailmessages by injecting a blocking packet into the e-mail data stream. Theblocking packet destroys the e-mail connection and stops the e-mailmessage from sending. For example, the redirection device may generateand inject an SMTP packet that mimics the subscriber packet, i.e.correct peer, port, and sequence numbering, with the reset flag set.This packet is obeyed by the upstream operating system which drops theconnection. Alternatively or in addition, a packet having a reset flagset may be injected downstream 28 to the subscriber 14, i.e. mirroringthe sender packet, so that the e-mail message is blocked by terminatingthe connection from the subscriber end. Other methods for automaticallyblocking the e-mail message may be apparent to the person skilled in theart and are considered equivalent.

The sending rate profile stored in database 24 determines whether asubscriber is blocked from sending emails. Every time an SMTP SYN packetis received from a subscriber, the subscriber's sending rate profile isupdated. In one embodiment, the subscriber is placed into the blockedstate if the subscriber's sending rate is greater than 20 per minute. Inone embodiment, the subscriber is placed into the blocked state if thesubscriber's sending rate is greater than 30 per minute. In oneembodiment, the subscriber is placed into the blocked state if thesubscriber's sending rate is greater than 40 per minute. In oneembodiment, the subscriber is placed into the blocked state if thesubscriber's sending rate is greater than 50 per minute. The personskilled in the art will understand that the above exemplary sendingrates are offered as examples only and that the specific sending raterequired to place the subscriber into the blocked state may bearbitrarily chosen by the ISP. In addition, the sending rate required toplace a subscriber into the blocked state need not be fixed by may bedynamically adjusted depending on various factors such as currentbandwidth utilization. In tests conducted by the present Applicantswhere unsolicited emails were being sent, the threshold sending rate wastypically exceeded within a few seconds, resulting in the user beingblocked quickly.

In one embodiment, the system may allow the automatic unblocking ofblocked subscribers. In order to unblock a subscriber, the sending ratemust drop below a required threshold, which may be the same thresholdthat was exceeded to block the subscriber or may be a differentthreshold. In one embodiment, the test required to release thesubscriber from the blocked state is made more stringent than the testrequired to block the subscriber, for example by setting the blockedthreshold to be at least three times greater than the unblockedthreshold. In one embodiment, the subscriber is placed into theunblocked state if the subscriber's sending rate is less than 10 perminute. In one embodiment, the subscriber is placed into the unblockedstate if the subscriber's sending rate is less than 5 per minute. In oneembodiment, the subscriber is placed into the unblocked state if thesubscriber's sending rate is less than 5 per two minutes. In oneembodiment, the subscriber is placed into the unblocked state if thesubscriber's sending rate is less than 5 messages in 5 minutes.

The sending rate profile of a subscriber may store an additional blockedstatus flag indicating the current blocked/unblocked status of thesubscriber. The blocked status flag may be used to determine whichthreshold is applied to the sending rate profile when a new e-mailmessage is sent by the subscriber. In one embodiment, the consolidatingand management device 26 updates the sending rate profiles only when newe-mail messages are sent by the subscriber. In this embodiment, ablocked subscriber will remain blocked until the subscriber attemptssending an e-mail within a timeframe allowable by the thresholdparameters. In an alternative embodiment, the consolidating andmanagement device 26 may periodically run a check query on the sendingrate profile database 24 to calculate the sending rates of subscriberswithin a current timeframe. If the query indicates that the sending rateprofile for any blocked subscriber has fallen below the rate required tounblock the subscriber, the subscriber's blocked status flag may bereset to the default unblocked status. It is important to note that theabove process although being automatic, also reduces significantly, theincidences of “false positives” since an intermittent intentional andvalid sending of a relatively large set of e-mail messages by asubscriber will result in a rapid restoration to the unblocked status,normally not differentiated from normal Internet conditions, and themessages from the subscriber will ultimately get through.

When a subscriber is initially blocked, the redirection device cantrigger the sending of a message to the subscriber indicating theblocked status and suggesting remedies to fix the problem. A message maybe sent through any suitable medium such as by an e-mail to thesubscriber.

In an alternative embodiment, a web-browser message may be sent to thesubscriber, using the techniques described in the Applicant's earlierapplications referenced above. For example, with reference to FIG. 4,when a subscriber 14 is initially blocked, a flag may be set in a policydatabase 38 that identifies the subscriber as requiring notification ofthe actions taken by the ISP 12. When the redirection device 21 receivesa web page request, the redirection device 21 processes the TCP SYNpacket to determine the IP address. The redirection device 21 thenchecks, via the consolidating and management device 26 whether anotification is pending for the current subscriber associated with theIP address. If a notification is pending, the redirection device 21provides to the subscriber an HTML redirection to destination server 39that combines the destination URL in the page request and the URL forthe message into a new page redirection for the subscriber's browser tofetch. In one embodiment, in addition to the requested page content 42,the new page 40 includes a banner 41 or similarly visible message thatindicates to the subscriber 14 that the subscriber's computer is sendinga high rate of e-mails and has been blocked. The banner may indicatethat the subscriber's computer has a virus and include a hyperlink 44 toa downloadable disinfection facility for removing the virus. In oneembodiment, the new page 40 may include an authentication code thatverifies the authenticity of the virus indication to the subscriber. Inone embodiment, the authentication code may be a shared secret, forexample as described in the Applicant's application Ser. No. 12/004,645referenced above.

In one embodiment depicted in FIG. 5, the ISP 12 includes at least oneprocessor 51 operatively associated with at least one memory 52. Thememory 52 stores an instruction set 500 executable on the processor 51.When executed, the processor 51 receives a plurality of e-mail messagesfrom the subscriber (501). The processor 51 then determines a sendingrate of the e-mail messages (502) and compares the sending rate with athreshold (503). If the sending rate is above an allowable threshold,the processor 51 prevents transmission of at least one of the e-mailmessages (504).

One advantage of the above described embodiments is that by relying onthe subscriber identity instead of merely the IP address, the system canprevent viruses and trojans from thwarting the system should thesubscriber acquire a different IP address. The subscriber identity is afixed identity, typically an identity assigned by the providerprovisioning system such as a modem serial number or MAC address and cannot be changed by the virus or trojan.

While one redirection device is shown within the ISP, the person skilledin the art will readily understand that any number of redirectionsdevices may be provided for processing upstream data packets. Inparticular, separate redirection devices may be provided for separatechannels within the ISP. Typically, a single consolidating andmanagement device can be used to manage a plurality of redirectionsdevices and to execute the queries to the databases. However, the personskilled in the art will readily understand that a plurality ofconsolidating and management devices may be employed.

An advantage of the embodiments herein described includes allowing thebehavior of unsolicited email senders to be monitored while maintainingthe block on the e-mails. That is, attempts to send e-mails may continuethrough the sending of fresh SMTP SYN packets even though the e-mailsare not successfully transmitted. The placement of a new SMTP SYN packetwill maintain the sending rate profile outside of the allowedparameters, thereby maintaining the block on the subscriber.

An advantage of the embodiments herein described include thatspam-sending issues can be resolved rapidly using network devices thatare relatively simple to install within the ISP and do not require allnetwork traffic to pass through them. In particular, the redirectiondevice 21 requires only read-only access to the data packets that itprocesses. A further advantage is that the embodiments may beimplemented without updates being required to subscriber hardware orsoftware and thus are instantly applicable across all subscribers to theISP.

While a single ISP has been described and illustrated, the personskilled in the art will readily understand that a plurality of ISPs maybe provided that utilize a common electronic mail management system orthat each have an associated electronic mail management system asdescribed above.

Although embodiments of the present invention have been illustrated inthe accompanied drawings and described in the foregoing description, itwill be understood that the invention is not limited to the embodimentsdisclosed, but is capable of numerous rearrangements, modifications, andsubstitutions without departing from the spirit of the invention as setforth and defined by the following claims. For example, the capabilitiesof the invention can be performed fully and/or partially by one or moreof the blocks, modules, processors or memories. Also, these capabilitiesmay be performed in the current manner or in a distributed manner andon, or via, any device able to provide and/or receive information.Further, although depicted in a particular manner, various modules orblocks may be repositioned without departing from the scope of thecurrent invention. Still further, although depicted in a particularmanner, a greater or lesser number of modules and connections can beutilized with the present invention in order to accomplish the presentinvention, to provide additional known features to the presentinvention, and/or to make the present invention more efficient. Also,the information sent between various modules can be sent between themodules via at least one of a data network, the Internet, an InternetProtocol network, a wireless source, and a wired source and viaplurality of protocols.

What is claimed is:
 1. A method, comprising: determining, via a sendingrate profile, that a subscriber has attempted to transmit a predefinednumber of electronic mail messages over a predefined period of time inresponse to an electronic mail message being received from thesubscriber; and injecting a blocking packet into an electronic mail datastream which blocks the transmission of the electronic mail message. 2.The method according to claim 1, comprising determining if saidsubscriber is a blocked subscriber, wherein determining if saidsubscriber is a blocked subscriber comprises: retrieving the sendingrate profile associated with a subscriber identity from at least onedatabase, said sending rate profile indicating a sending rate ofelectronic mail messages by said subscriber; and determining if saidsending rate profile indicates if said subscriber is a blockedsubscriber, and wherein when an electronic mail packet is received froma subscriber, the subscriber's sending rate profile is updated.
 3. Themethod according to claim 1 comprising updating the subscriber's sendingrate profile to indicate an attempt to send the electronic mail messagereceived from the subscriber.
 4. The method according to claim 2 whereinsaid sending rate profile comprises a blocked status flag that indicatesa blocked status if a sending rate of electronic mail messages by saidsubscriber is above an allowed threshold, and processing said blockedstatus flag.
 5. The method according to claim 2 wherein determining ifsaid sending rate profile indicates if said subscriber is a blockedsubscriber comprises determining if an electronic mail sending rateassociated with said subscriber is above a threshold rate.
 6. The methodaccording to claim 2 further comprising: calculating a current sendingrate of electronic mail messages by said subscriber; and utilizing saidcurrent sending rate to update said sending rate profile of saidsubscriber.
 7. The method according to claim 6 wherein the calculatingthe current sending rate utilizes said electronic mail message.
 8. Themethod according to claim 6 wherein the subscriber is determined to be ablocked subscriber if said current sending rate is above a firstthreshold.
 9. The method according to claim 8 wherein a blockedsubscriber is determined to be an unblocked subscriber if said currentsending rate is below a second threshold.
 10. The method according toclaim 9 wherein said first threshold is greater than said secondthreshold.
 11. The method according to claim 1 wherein the preventingthe transmission of said electronic mail message occurs on a point on atransmission path and comprises providing a transmission that destroys aconnection between the subscriber and an intended recipient of saidelectronic mail message.
 12. The method according to claim 11 whereinthe provided transmission comprises at least one of a reset transmissionand an SMTP packet in which a reset flag is set.
 13. The methodaccording to claim 1 further comprising providing a notification messageto said subscriber indicating that a blocking action has been performed.14. The method according to claim 13 further comprising: detecting a URLpage request from the subscriber; and redirecting said URL page requestsuch that the subscriber retrieves a URL page comprising saidnotification message.
 15. The method according to claim 14 wherein saidURL page comprises a hyperlink to a virus removal facility.
 16. Asystem, comprising: at least one electronic mail processing apparatuscomprising: a memory that stores at least one database; and at least onequery engine coupled to a processor that executes one or more queries onsaid at least one database; wherein said electronic mail processingsystem apparatus receives an electronic mail message from one or moresubscribers; wherein said query engine executes a query on said at leastone database to determine a subscriber identity associated with saidelectronic mail message; when the subscriber has attempted to transmit apredefined number of email messages over a predefined period of time,the subscriber is blocked from being able to send an electronic mailmessage via an injection of a blocking packet into an electronic maildata stream, which stops the electronic mail messages from being sent.17. A system, comprising: at least one router; and a packet processingengine coupled to a processor; wherein said at least one router routesone or more electronic mail packets that identify a recipient to saidpacket processing engine; wherein if said one or more electronic mailpacket are to be blocked, said packet processing engine routes ablocking packet to said router; wherein said router transmits saidblocking packet towards said recipient which blocks the subscriber frombeing able to send electronic mail packet which stops the electronicmail packets from being sent; and wherein a sending rate profileindicates whether the subscriber is currently blocked from atransmission of electronic mail messages based on a determination ofwhether the subscriber has attempted to transmit a predefined number ofemail messages over a predefined period of time.
 18. The systemaccording to claim 17 wherein when an electronic mail packet is receivedfrom a subscriber, the subscriber's sending rate profile is updated toindicate a user's attempt to send the electronic mail message.
 19. Amethod, comprising: blocking transmission of one or more packets into aninternet service provider from a subscriber, wherein a sending rateprofile indicates whether the subscriber is currently blocked fromtransmitting electronic mail messages based on determination whether thesubscriber has attempted to transmit a predefined number of emailmessages over a predefined period of time; determining, via the sendingrate profile, whether the subscriber is exceeding at least one thresholdapplied to the sending rate profile when said electronic mail message isreceived from the subscriber; and blocking the subscriber from sendingelectronic mail messages by injecting a blocking packet into anelectronic mail data stream, which stops the electronic mail messagesfrom being sent.
 20. A non-transitory computer readable storage mediumconfigured to store computer instructions that when executed causes aprocessor to perform: determining a sending rate of a plurality ofelectronic mail messages from a subscriber; comparing said sending ratewith a threshold; preventing transmission of at least one of saidelectronic mail messages if said sending rate is above said threshold;wherein a sending rate profile indicates whether the subscriber iscurrently blocked from transmitting electronic mail messages based on adetermination whether the subscriber has attempted to transmit apredefined number of email messages over a predefined period of time;and blocking the subscriber from sending electronic mail messages byinjecting a blocking packet into an electronic mail data stream, whichstops the electronic mail messages from being sent.